Email: 489820 Autolearn: 0 AvgScore: 1.54 AvgScanTime: 2.01 sec Spam: 119357 Autolearn: 0 AvgScore: 13.66 AvgScanTime: 2.35 sec Ham: 370463 Autolearn: 0 AvgScore: -2.36 AvgScanTime: 1.91 sec Time Spent Running SA: 274.12 hours Time Spent Processing Spam: 77.95 hours Time Spent Processing Ham: 196.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114368 88.95 95.82 86.73 2 DKIM_SIGNED 104605 71.41 87.64 66.18 3 XM_DK_Pass 100990 69.48 84.61 64.61 4 DKIM_VALID 97383 67.14 81.59 62.48 5 RELAYCOUNTRY_US 97181 81.92 81.42 82.08 6 XM_B_Unicode 96374 72.68 80.74 70.08 7 DCC_CHECK 88027 39.85 73.75 28.93 8 XMListUnsubscribeExists 84125 48.01 70.48 40.77 9 XM_B_SpammyWords 84101 50.31 70.46 43.82 10 DKIM_VALID_AU 72261 50.57 60.54 47.36 11 XM_DK_Undo_02 56279 16.04 47.15 6.02 12 XM_B_Unicode3 51500 43.46 43.15 43.56 13 BAYES_50 46585 49.83 39.03 53.31 14 XM_B_SpammyWords2 45609 21.41 38.21 15.99 15 TR_XM_DKIM_Undo 44560 12.50 37.33 4.50 16 BAYES_99 42799 12.43 35.86 4.88 17 LOC_TINY_FONT_1 42500 23.73 35.61 19.90 18 HTML_FONT_LOW_CONTRAST 40031 26.67 33.54 24.45 19 FVGT_m_MULTI_ODD 37088 24.22 31.07 22.01 20 T_KAM_HTML_FONT_INVALID 36821 20.15 30.85 16.71 21 DKIM_VALID_EF 35658 26.46 29.88 25.36 22 MIME_HTML_ONLY 34971 20.84 29.30 18.11 23 BAYES_999 34448 10.01 28.86 3.94 24 TR_DCC_Bayes_99 31980 7.70 26.79 1.55 25 DCC_CHECK_NEGATIVE 31290 60.11 26.22 71.02 26 T_TM2_M_HEADER_IN_MSG 29829 34.01 24.99 36.92 27 XM_Body_Dirty_Words 28920 13.93 24.23 10.61 28 XMSubLong 28574 20.90 23.94 19.92 29 RCVD_IN_MSPIKE_WL 28126 25.08 23.56 25.56 30 RCVD_IN_MSPIKE_H2 27485 20.19 23.03 19.28 31 RELAYCOUNTRY_META 23430 7.26 19.63 3.28 32 XM_Multi_Part_URI 19262 11.68 16.14 10.24 33 XM_B_Unsub 16800 10.27 14.08 9.04 34 TR_XM_SpammyRelay 15326 4.09 12.84 1.27 35 BOTNET_IPINHOSTNAME 15091 5.89 12.64 3.72 36 XM_B_SpammyWords3 15002 5.67 12.57 3.45 37 UNPARSEABLE_RELAY 14877 8.24 12.46 6.88 38 TR_XM_SpammyWords2 14757 3.63 12.36 0.81 39 LOTS_OF_MONEY 14688 11.08 12.31 10.69 40 RCVD_IN_MSPIKE_H4 14590 10.68 12.22 10.18 41 TR_XM_UnparsRelay 14411 6.94 12.07 5.29 42 BOTNET 13903 3.79 11.65 1.26 43 FSL_BULK_SIG 13303 5.40 11.15 3.55 44 UNTRUSTED_Relay 12930 3.48 10.83 1.11 45 RCVD_IN_MSPIKE_H3 12924 12.95 10.83 13.63 46 XM_UncommonTLD01 12916 5.08 10.82 3.23 47 XMSexyCombo_05 12698 4.80 10.64 2.92 48 TR_XM_SpammyWords4 12439 7.02 10.42 5.93 49 XM_Evil_Numbers_Gen 11470 7.86 9.61 7.30 50 MPART_ALT_DIFF 11014 5.56 9.23 4.37 51 XM_SendGrid 10551 6.28 8.84 5.46 52 TR_XM_PhishingBody 10059 4.50 8.43 3.24 53 RCVD_IN_BL_SPAMCOP_NET 9919 2.53 8.31 0.66 54 BAYES_80 9784 4.89 8.20 3.83 55 HTML_IMAGE_RATIO_02 8997 6.01 7.54 5.51 56 LotsOfNums_01 8995 8.24 7.54 8.47 57 BAYES_60 8847 8.26 7.41 8.53 58 TR_XM_MaxUnsub 8318 2.36 6.97 0.88 59 XMSubMetaSx_00 7935 4.25 6.65 3.48 60 XM_B_Phish_Phrases 7680 4.22 6.43 3.51 61 MIME_HTML_MOSTLY 7635 3.00 6.40 1.91 62 RCVD_IN_MSPIKE_BL 7400 2.19 6.20 0.90 63 TR_XM_MSPIKECOMBO 7390 2.18 6.19 0.89 64 DKIM_INVALID 7222 4.27 6.05 3.70 65 TooManyTo_001 6527 7.73 5.47 8.46 66 XM_B_Phish66 6469 2.96 5.42 2.16 67 XM_H_Long_From01 6342 4.71 5.31 4.51 68 URI_NOVOWEL 6195 3.23 5.19 2.60 69 TR_XM_DK_SendGrid 6176 3.86 5.17 3.43 70 XM_UB50 5941 1.77 4.98 0.74 71 TR_XM_SpammyWords5 5890 2.09 4.93 1.17 72 RELAYCOUNTRY_CA 5840 1.71 4.89 0.68 73 XM_B_Investor 5836 2.32 4.89 1.49 74 T_REMOTE_IMAGE 5736 3.89 4.81 3.60 75 TR_XM_SPAMCOP 5655 1.35 4.74 0.26 76 SpammyFromTLD_02 5482 1.28 4.59 0.21 77 HTML_MIME_NO_HTML_TAG 5397 2.78 4.52 2.22 78 SpammyFromTLD_01 5364 1.60 4.49 0.67 79 XM_SPF_SoftFail 5230 8.73 4.38 10.13 80 T_XMDrugObfuBody_14 5192 2.49 4.35 1.88 81 XMNumbers 5176 3.68 4.34 3.47 82 BAYES_95 5115 2.79 4.29 2.31 83 T_XMDrugObfuBody_08 5028 2.18 4.21 1.53 84 HTML_IMAGE_RATIO_04 4971 4.69 4.16 4.86 85 KHOP_HELO_FCRDNS 4936 5.36 4.14 5.76 86 TR_XM_SpammyWords3 4803 1.33 4.02 0.46 87 XM_OfRef6 4637 1.60 3.88 0.86 88 XMBody_17 4373 1.35 3.66 0.61 89 MIME_HTML_ONLY_MULTI 4326 3.15 3.62 3.00 90 HTML_IMAGE_RATIO_06 4302 3.57 3.60 3.56 91 MIME_QP_LONG_LINE 4227 4.74 3.54 5.13 92 XM_DIRTYINTL 3969 1.01 3.33 0.27 93 RCVD_IN_VALIDITY_SAFE 3950 3.71 3.31 3.84 94 XM_B_SpammyTLD 3839 2.19 3.22 1.85 95 T_FILL_THIS_FORM_SHORT 3826 1.52 3.21 0.98 96 TM2_M_URI_OPT_OUT 3819 2.78 3.20 2.64 97 TM2_M_VERY_LONG_WORD 3755 1.84 3.15 1.42 98 T_TooManySym_01 3669 5.75 3.07 6.61 99 XMStrtUSub 3557 3.56 2.98 3.75 100 RCVD_IN_MSPIKE_L3 3470 0.98 2.91 0.36 101 RCVD_IN_VALIDITY_CERTIFIED 3250 3.23 2.72 3.39 102 HTML_IMAGE_RATIO_08 3237 7.29 2.71 8.77 103 TR_XM_SB_Phish 3213 2.39 2.69 2.29 104 JH_SPAMMY_HEADERS 3161 0.65 2.65 0.00 105 XMSubPhish11 3142 2.21 2.63 2.07 106 XM_CamelCaseFrm001 3125 1.79 2.62 1.52 107 SUBJ_ALL_CAPS 3124 2.81 2.62 2.88 108 XM_B_COVIDMETA 3120 1.04 2.61 0.53 109 RCVD_IN_IADB_LISTED 3088 4.22 2.59 4.75 110 RELAYCOUNTRY_FR 3080 0.79 2.58 0.21 111 USER_IN_DEF_DKIM_WL 3054 8.53 2.56 10.45 112 XMDiploma_00 2953 1.60 2.47 1.32 113 TR_XM_COVIDMETA1 2944 0.76 2.47 0.21 114 HTML_IMAGE_ONLY_08 2929 0.69 2.45 0.13 115 TR_XM_PHPDW 2678 0.81 2.24 0.35 116 HTML_TAG_BALANCE_CENTER 2656 0.58 2.23 0.05 117 TR_XM_PHPForged 2624 0.76 2.20 0.30 118 XM_DK_Undo_01 2592 1.85 2.17 1.75 119 TR_XM_FormFill 2575 0.62 2.16 0.12 120 TR_XM_FormFill2 2573 0.75 2.16 0.29 121 RCVD_IN_VALIDITY_RPBL 2572 0.58 2.15 0.07 122 XM_H_PHPOS 2547 0.74 2.13 0.29 123 RCVD_IN_IADB_SPF 2537 3.66 2.13 4.15 124 URI_HEX 2476 1.49 2.07 1.30 125 RCVD_IN_MSPIKE_L5 2407 0.57 2.02 0.11 126 FROM_EXCESS_BASE64 2381 2.34 1.99 2.45 127 ALL_TRUSTED 2379 12.49 1.99 15.87 128 XM_URI_RBL 2363 0.56 1.98 0.10 129 XMStockSpam_06 2349 1.40 1.97 1.21 130 XM_B_Unsub2 2347 1.42 1.97 1.25 131 MAILING_LIST_MULTI 2341 2.86 1.96 3.15 132 RCVD_IN_IADB_DK 2330 3.19 1.95 3.59 133 RCVD_IN_IADB_SENDERID 2302 3.27 1.93 3.70 134 XM_B_SpammyWords4 2278 0.73 1.91 0.35 135 MIXED_HREF_CASE 2197 0.45 1.84 0.00 136 MIXED_CENTER_CASE 2197 0.45 1.84 0.00 137 MIXED_IMG_CASE 2193 0.45 1.84 0.00 138 MIXED_AREA_CASE 2188 0.45 1.83 0.00 139 MIXED_FONT_CASE 2184 0.45 1.83 0.00 140 BAYES_40 2179 3.97 1.83 4.66 141 HTML_FONT_SIZE_LARGE 2067 0.51 1.73 0.11 142 TR_XM_INV_DKIM 2065 0.57 1.73 0.20 143 T_XMDrugObfuBody_00 2058 0.95 1.72 0.70 144 RELAYCOUNTRY_AU 2058 0.63 1.72 0.27 145 XMSexyCombo_01 2046 1.09 1.71 0.89 146 BODY_URI_ONLY 2022 0.42 1.69 0.01 147 TR_XM_COVIDMETA4 1979 0.69 1.66 0.38 148 TR_XM_NoHeaderRelay 1923 0.53 1.61 0.19 149 URIBL_DBL_SPAM 1918 0.40 1.61 0.01 150 URIBL_BLACK 1918 0.42 1.61 0.04 151 XM_UB99 1882 0.39 1.58 0.00 152 XM_UB60 1871 0.44 1.57 0.08 153 TM2_M_A_HREF_HREF 1848 0.60 1.55 0.29 154 T_XMHurry_00 1834 0.68 1.54 0.40 155 XMBrknScrpt_02 1822 1.14 1.53 1.01 156 XM_B_Crypto 1778 0.57 1.49 0.27 157 RCVD_IN_IADB_VOUCHED 1739 2.55 1.46 2.90 158 BAYES_20 1719 3.23 1.44 3.81 159 URI_NO_WWW_BIZ_CGI 1691 0.35 1.42 0.00 160 XMGenDplmaNmb 1669 0.98 1.40 0.84 161 FONT_INVIS_LONG_LINE 1641 0.39 1.37 0.07 162 XMSubMetaI_00 1617 0.57 1.35 0.32 163 TR_Caps_n_Bayes_99 1593 0.39 1.33 0.09 164 XMHTML_After_End 1585 0.88 1.33 0.73 165 PDS_OTHER_BAD_TLD 1574 0.69 1.32 0.48 166 BOTNET_NORDNS 1519 0.32 1.27 0.01 167 RCVD_IN_MSPIKE_L4 1513 0.62 1.27 0.42 168 RCVD_IN_PSBL 1511 0.41 1.27 0.13 169 XM_ProductURIs 1462 0.81 1.22 0.68 170 RELAYCOUNTRY_IN 1447 0.37 1.21 0.10 171 XM_UB999 1447 0.30 1.21 0.00 172 GOOG_STO_IMG_HTML 1435 0.29 1.20 0.00 173 XMPhish30 1421 0.66 1.19 0.49 174 XM_GoogleGroups 1420 1.24 1.19 1.26 175 TR_Symld_Words 1366 1.65 1.14 1.81 176 URI_TRY_3LD 1352 0.70 1.13 0.56 177 XM_H_PHPMailer 1332 0.78 1.12 0.67 178 BAYES_00 1326 12.12 1.11 15.67 179 TR_LOTS_OF_MONEY3 1309 0.40 1.10 0.17 180 HTML_TAG_BALANCE_BODY 1299 0.63 1.09 0.49 181 RELAYCOUNTRY_GB 1289 0.88 1.08 0.81 182 RELAYCOUNTRY_DE 1287 0.44 1.08 0.23 183 HTTPS_HTTP_MISMATCH 1281 0.79 1.07 0.70 184 XM_UB80 1280 0.27 1.07 0.01 185 HTML_FONT_SIZE_HUGE 1279 0.29 1.07 0.04 186 TR_MetaPhish_Combo_01 1271 0.77 1.06 0.67 187 FROM_SUSPICIOUS_NTLD 1261 0.29 1.06 0.05 188 TR_Mismatch_TLD_01 1258 0.44 1.05 0.25 189 TR_Mismatch_TLD_02 1247 0.31 1.04 0.08 190 DKIM_ADSP_CUSTOM_MED 1237 0.95 1.04 0.92 191 TR_XM_BayesRelay 1210 0.25 1.01 0.00 192 T_Symld_Words_02 1208 0.62 1.01 0.50 193 TR_BOTNET_NEGATE 1201 0.42 1.01 0.23 194 FROM_SUSPICIOUS_NTLD_FP 1186 0.28 0.99 0.04 195 DIET_1 1183 0.44 0.99 0.26 196 XM_PDF 1183 4.13 0.99 5.14 197 XM_Body_Dirty_Words_01 1176 0.36 0.99 0.16 198 URI_GOOG_STO_SPAMMY 1169 0.24 0.98 0.00 199 TR_XM_Spammywords 1165 0.46 0.98 0.29 200 XM_S_SpammyWords 1165 0.46 0.98 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 321314 88.95 95.82 86.73 2 RELAYCOUNTRY_US 304074 81.92 81.42 82.08 3 DCC_CHECK_NEGATIVE 263117 60.11 26.22 71.02 4 XM_B_Unicode 259635 72.68 80.74 70.08 5 DKIM_SIGNED 245183 71.41 87.64 66.18 6 XM_DK_Pass 239342 69.48 84.61 64.61 7 DKIM_VALID 231481 67.14 81.59 62.48 8 BAYES_50 197505 49.83 39.03 53.31 9 DKIM_VALID_AU 175438 50.57 60.54 47.36 10 XM_B_SpammyWords 162329 50.31 70.46 43.82 11 XM_B_Unicode3 161386 43.46 43.15 43.56 12 XMListUnsubscribeExists 151037 48.01 70.48 40.77 13 T_TM2_M_HEADER_IN_MSG 136776 34.01 24.99 36.92 14 DCC_CHECK 107178 39.85 73.75 28.93 15 RCVD_IN_MSPIKE_WL 94700 25.08 23.56 25.56 16 DKIM_VALID_EF 93936 26.46 29.88 25.36 17 HTML_FONT_LOW_CONTRAST 90596 26.67 33.54 24.45 18 FVGT_m_MULTI_ODD 81544 24.22 31.07 22.01 19 XMSubLong 73810 20.90 23.94 19.92 20 LOC_TINY_FONT_1 73714 23.73 35.61 19.90 21 RCVD_IN_MSPIKE_H2 71407 20.19 23.03 19.28 22 MIME_HTML_ONLY 67102 20.84 29.30 18.11 23 T_KAM_HTML_FONT_INVALID 61893 20.15 30.85 16.71 24 XM_B_SpammyWords2 59245 21.41 38.21 15.99 25 ALL_TRUSTED 58776 12.49 1.99 15.87 26 BAYES_00 58035 12.12 1.11 15.67 27 IN_ZIMBRA_NJ_WHITELIST 53462 10.94 0.11 14.43 28 RCVD_IN_MSPIKE_H3 50500 12.95 10.83 13.63 29 LOTS_OF_MONEY 39603 11.08 12.31 10.69 30 XM_Body_Dirty_Words 39298 13.93 24.23 10.61 31 USER_IN_DEF_DKIM_WL 38726 8.53 2.56 10.45 32 XM_Multi_Part_URI 37926 11.68 16.14 10.24 33 RCVD_IN_MSPIKE_H4 37713 10.68 12.22 10.18 34 XM_SPF_SoftFail 37530 8.73 4.38 10.13 35 HTML_FONT_FACE_BAD 33698 7.07 0.80 9.10 36 XM_B_Unsub 33500 10.27 14.08 9.04 37 HTML_IMAGE_RATIO_08 32487 7.29 2.71 8.77 38 BAYES_60 31589 8.26 7.41 8.53 39 LotsOfNums_01 31378 8.24 7.54 8.47 40 TooManyTo_001 31324 7.73 5.47 8.46 41 XM_Evil_Numbers_Gen 27046 7.86 9.61 7.30 42 XM_DKIMWhitelistDomains 26288 5.38 0.06 7.10 43 UNPARSEABLE_RELAY 25480 8.24 12.46 6.88 44 T_TooManySym_01 24477 5.75 3.07 6.61 45 TR_XM_DK_Bayes 22895 4.84 0.69 6.18 46 XM_DK_Undo_02 22290 16.04 47.15 6.02 47 TR_XM_DK_Bayes1 22057 4.67 0.67 5.95 48 TR_XM_SpammyWords4 21955 7.02 10.42 5.93 49 KHOP_HELO_FCRDNS 21341 5.36 4.14 5.76 50 HTML_IMAGE_RATIO_02 20427 6.01 7.54 5.51 51 XM_SendGrid 20226 6.28 8.84 5.46 52 TR_XM_UnparsRelay 19585 6.94 12.07 5.29 53 XM_PDF 19032 4.13 0.99 5.14 54 MIME_QP_LONG_LINE 19003 4.74 3.54 5.13 55 FILL_THIS_FORM 18784 3.88 0.18 5.07 56 TR_XM_DK_Bayes2 18440 3.90 0.56 4.98 57 BAYES_99 18077 12.43 35.86 4.88 58 HTML_IMAGE_RATIO_04 18004 4.69 4.16 4.86 59 RCVD_IN_IADB_LISTED 17587 4.22 2.59 4.75 60 BAYES_40 17262 3.97 1.83 4.66 61 XM_H_Long_From01 16719 4.71 5.31 4.51 62 TR_XM_DKIM_Undo 16680 12.50 37.33 4.50 63 MPART_ALT_DIFF 16201 5.56 9.23 4.37 64 RCVD_IN_IADB_SPF 15380 3.66 2.13 4.15 65 BAYES_999 14593 10.01 28.86 3.94 66 RCVD_IN_VALIDITY_SAFE 14210 3.71 3.31 3.84 67 BAYES_80 14183 4.89 8.20 3.83 68 BAYES_20 14120 3.23 1.44 3.81 69 XMStrtUSub 13879 3.56 2.98 3.75 70 BOTNET_IPINHOSTNAME 13772 5.89 12.64 3.72 71 RCVD_IN_IADB_SENDERID 13718 3.27 1.93 3.70 72 DKIM_INVALID 13702 4.27 6.05 3.70 73 T_TooManySym_02 13623 3.00 0.91 3.68 74 T_REMOTE_IMAGE 13339 3.89 4.81 3.60 75 RCVD_IN_IADB_DK 13297 3.19 1.95 3.59 76 HTML_IMAGE_RATIO_06 13188 3.57 3.60 3.56 77 FSL_BULK_SIG 13161 5.40 11.15 3.55 78 XM_B_Phish_Phrases 13013 4.22 6.43 3.51 79 XMSubMetaSx_00 12889 4.25 6.65 3.48 80 XMNumbers 12842 3.68 4.34 3.47 81 XM_B_SpammyWords3 12766 5.67 12.57 3.45 82 XM_H_Trusted_IP 12756 2.60 0.00 3.44 83 TR_XM_DK_SendGrid 12708 3.86 5.17 3.43 84 RCVD_IN_VALIDITY_CERTIFIED 12547 3.23 2.72 3.39 85 RELAYCOUNTRY_META 12133 7.26 19.63 3.28 86 TR_XM_PhishingBody 11998 4.50 8.43 3.24 87 XM_UncommonTLD01 11966 5.08 10.82 3.23 88 ANY_BOUNCE_MESSAGE 11813 2.65 0.96 3.19 89 BOUNCE_MESSAGE 11812 2.65 0.96 3.19 90 MAILING_LIST_MULTI 11684 2.86 1.96 3.15 91 MIME_HTML_ONLY_MULTI 11097 3.15 3.62 3.00 92 XMSexyCombo_05 10828 4.80 10.64 2.92 93 RCVD_IN_IADB_VOUCHED 10737 2.55 1.46 2.90 94 SUBJ_ALL_CAPS 10664 2.81 2.62 2.88 95 BAYES_05 10452 2.30 0.69 2.82 96 TM2_M_URI_OPT_OUT 9789 2.78 3.20 2.64 97 URI_NOVOWEL 9650 3.23 5.19 2.60 98 FROM_EXCESS_BASE64 9060 2.34 1.99 2.45 99 TooManyTo_002 8812 1.99 0.78 2.38 100 BAYES_95 8558 2.79 4.29 2.31 101 TR_XM_SB_Phish 8502 2.39 2.69 2.29 102 HTML_MIME_NO_HTML_TAG 8238 2.78 4.52 2.22 103 XM_B_Phish66 8006 2.96 5.42 2.16 104 XMSubPhish11 7673 2.21 2.63 2.07 105 HELO_NODOT 7340 1.68 0.75 1.98 106 HELO_NO_DOMAIN 7339 1.68 0.75 1.98 107 RCVD_IN_IADB_OPTIN 7123 1.65 0.81 1.92 108 MIME_HTML_MOSTLY 7070 3.00 6.40 1.91 109 T_XMDrugObfuBody_14 6983 2.49 4.35 1.88 110 XM_B_SpammyTLD 6865 2.19 3.22 1.85 111 XM_E_Blogspot 6855 1.43 0.11 1.85 112 INVALID_MSGID 6839 1.44 0.18 1.85 113 TR_Symld_Words 6697 1.65 1.14 1.81 114 IN_HORDE_ADDRESS_BOOK 6686 1.39 0.11 1.80 115 RCVD_IN_MSPIKE_H5 6487 1.45 0.51 1.75 116 XM_DK_Undo_01 6483 1.85 2.17 1.75 117 MSGID_NOFQDN1 6363 1.31 0.06 1.72 118 TO_MALFORMED 6179 1.26 0.00 1.67 119 TooManyTo_003 6032 1.39 0.65 1.63 120 TVD_RCVD_IP 5770 1.22 0.16 1.56 121 TR_DCC_Bayes_99 5759 7.70 26.79 1.55 122 T_XMDrugObfuBody_08 5667 2.18 4.21 1.53 123 XM_CamelCaseFrm001 5628 1.79 2.62 1.52 124 XM_B_Investor 5510 2.32 4.89 1.49 125 TM2_M_VERY_LONG_WORD 5247 1.84 3.15 1.42 126 XMDiploma_00 4893 1.60 2.47 1.32 127 XMCapTrack 4887 1.10 0.44 1.32 128 XMSubNoVowel 4880 1.15 0.64 1.32 129 URI_HEX 4799 1.49 2.07 1.30 130 TR_XM_SpammyRelay 4721 4.09 12.84 1.27 131 XM_GoogleGroups 4666 1.24 1.19 1.26 132 BOTNET 4651 3.79 11.65 1.26 133 XM_B_Unsub2 4618 1.42 1.97 1.25 134 XMStockSpam_06 4499 1.40 1.97 1.21 135 TooManyTo_004 4457 1.05 0.56 1.20 136 XMGappySubj_01 4403 0.94 0.16 1.19 137 TR_XM_SpammyWords5 4350 2.09 4.93 1.17 138 XMNoVowels 4215 0.94 0.33 1.14 139 UNTRUSTED_Relay 4122 3.48 10.83 1.11 140 TVD_SPACE_RATIO 3781 0.80 0.10 1.02 141 XMBrknScrpt_02 3744 1.14 1.53 1.01 142 TooManyTo_005 3672 0.87 0.51 0.99 143 T_FILL_THIS_FORM_SHORT 3628 1.52 3.21 0.98 144 XMBSHREFv2 3433 0.79 0.35 0.93 145 XM_H_Long_From02 3433 0.94 0.97 0.93 146 DKIM_ADSP_CUSTOM_MED 3421 0.95 1.04 0.92 147 T_TooManySym_03 3406 0.78 0.33 0.92 148 RCVD_IN_MSPIKE_BL 3331 2.19 6.20 0.90 149 XMSexyCombo_01 3301 1.09 1.71 0.89 150 TR_XM_MSPIKECOMBO 3291 2.18 6.19 0.89 151 TR_XM_MaxUnsub 3254 2.36 6.97 0.88 152 XM_OfRef6 3177 1.60 3.88 0.86 153 XMGenDplmaNmb 3110 0.98 1.40 0.84 154 TR_XM_SpammyWords2 3016 3.63 12.36 0.81 155 RELAYCOUNTRY_GB 3003 0.88 1.08 0.81 156 XMSubMetaSxObfu_03 2897 0.77 0.72 0.78 157 RCVD_IN_RP_SAFE 2874 0.75 0.68 0.78 158 XMDateMe_00 2846 0.75 0.70 0.77 159 XMBody_95 2726 0.61 0.21 0.74 160 XM_UB50 2726 1.77 4.98 0.74 161 XMHTML_After_End 2705 0.88 1.33 0.73 162 RCVD_IN_RP_CERTIFIED 2629 0.65 0.49 0.71 163 T_XMDrugObfuBody_00 2610 0.95 1.72 0.70 164 HTTPS_HTTP_MISMATCH 2583 0.79 1.07 0.70 165 HTML_IMAGE_ONLY_20 2533 0.59 0.31 0.68 166 RELAYCOUNTRY_CA 2525 1.71 4.89 0.68 167 XM_ProductURIs 2523 0.81 1.22 0.68 168 XM_H_PHPMailer 2498 0.78 1.12 0.67 169 TR_MetaPhish_Combo_01 2488 0.77 1.06 0.67 170 SpammyFromTLD_01 2485 1.60 4.49 0.67 171 RCVD_IN_BL_SPAMCOP_NET 2453 2.53 8.31 0.66 172 XM_ShortIntro_01 2325 0.63 0.65 0.63 173 T_OBFU_PDF_ATTACH 2251 0.49 0.11 0.61 174 NML_ADSP_CUSTOM_MED 2250 0.64 0.73 0.61 175 XMBody_17 2244 1.35 3.66 0.61 176 MISSING_HEADERS 2219 0.60 0.60 0.60 177 XMBdyGiftCard01 2208 0.68 0.92 0.60 178 SHORT_HELO_AND_INLINE_IMAGE 2192 0.47 0.11 0.59 179 RCVD_IN_SORBS_DUL 2190 0.55 0.42 0.59 180 URI_TRY_3LD 2067 0.70 1.13 0.56 181 XMSexyCombo_04 2022 0.55 0.55 0.55 182 XM_B_COVIDMETA 1957 1.04 2.61 0.53 183 XMLngstWrd_00 1914 0.62 0.96 0.52 184 T_Symld_Words_02 1852 0.62 1.01 0.50 185 XMPhish30 1820 0.66 1.19 0.49 186 HTML_TAG_BALANCE_BODY 1803 0.63 1.09 0.49 187 XM_B_COPY_HTML 1801 0.56 0.81 0.49 188 PDS_OTHER_BAD_TLD 1793 0.69 1.32 0.48 189 HTML_IMAGE_ONLY_32 1771 0.43 0.30 0.48 190 XMLngstWrd_01 1733 0.58 0.93 0.47 191 FORGED_GMAIL_RCVD 1726 0.56 0.87 0.47 192 TR_MSPIKEBAYES00 1721 0.36 0.02 0.46 193 FROM_GOV_SPOOF 1694 0.37 0.11 0.46 194 TR_XM_SpammyWords3 1688 1.33 4.02 0.46 195 MPART_ALT_DIFF_COUNT 1652 0.54 0.83 0.45 196 T_TooManySym_04 1609 0.36 0.15 0.43 197 XMHTMLBadTable_001 1594 0.54 0.88 0.43 198 FROM_GOV_DKIM_AU 1591 0.36 0.15 0.43 199 TM2_M_BODY_EMPTY 1569 0.37 0.18 0.42 200 XMMoneyMeta_00 1557 0.55 0.97 0.42 ----------------------------------------------------------------------